CVE-2016-5008

Critical

Published: 13/07/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In libvirt versions before 2.0.0, password checking is improperly disabled when the password on a VNC server is set to an empty string. This allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.

Risk Assessment

Organizations may be exposed to unauthorized access to VNC servers, potentially leading to data breaches or system takeover.

Recommendation

It is recommended to upgrade libvirt to version 2.0.0 or later to ensure proper password checking on the VNC server.

Original NVD description (English source)

libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.